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Executive reporting on internal control has received great professional 
interest and has been the subject of heated discussions as to its pros and 
cons. Most of the controversy resulted from the Foreign Corrupt Practices 
Act of 1977 and the Securities and Exchange Commission's proposal to implement 
the Act with a requirement that certain companies provide a statement on the 
effectiveness of internal control systems with their annual reports. Further, 
certain Congressional committees became interested in proposing legislation 
that would require Federal executives to prepare annual reports on the 
adequacy of agency internal control. 

In April, 1979, Arthur Schoenhaut, the National President, offered AGA's 
assistance to the U.S. Comptroller General in developing standards dealing 
with a Federal Executive report on Internal Control. In May, the Comptroller 
General accepted the offer, and the succeeding National President Frank Sato 
appointed a Task Force to propose such standards. 

The Task Force's mission was not to debate or review the pros and cons 
of the executive reporting or the need for such legislation, but was to pro- 
vide standards and procedures that can be followed if and when such legis- 
lation should be passed. For the past year the Task Force has worked seri- 
ously, diligently and enthusiastically to meet this mandate. We, the Task 
Force members, are proud and pleased to present this document in fulfilling 
our mission. It is our ardent hope and belief that this document will go a 
long way in advancing the state of the art in the very critical area of inter- 
nal control. We are all pleased and honored to have been part of this effort. 
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PRELUDE 

More than 25 years prior to the enactment by the Congress 
of the Foreign Corrupt Practices Act (FCPA) mandating the main- 
tenance of proper recordkeeping and internal accounting control 
systems in the private sector, a provision was included in the 
Budget and Accounting Procedures Act of 1950 requiring manage- 
ments of all major Federal departments to implement and maintain 
effective systems of internal control in Government. Although 
there were undoubtedly many who took this charge seriously, the 
intervening period could be characterized as one in which move- 
ment toward the development of effective Government systems was 
undoubtedly slower than contemplated by the drafters of the 
legislation and often marked by the allocation of inadequate 
resources to the task. Certainly the length of time which has 
been consumed in the achievement of the General Accounting Office 
approval of agency accounting systems evidences a need for 
increased emphasis on the importance of accounting and control 
systems . 

The importance of internal controls in the financial opera- 
tions of an entity, be it public or private, has been dramatic- 
ally demonstrated in Congressional testimony and other responses 
during and subsequent to the passage of FCPA legislation. In the 
late 70 's the Goverment also experienced a rash of its own form 
of illegal, unauthorized, and questionable payments in the form 
of what has later been described as fraud, waste and abuse, 
thereby underlining the importance of the internal controls in 
Government. The seemingly unending disclosure of a broad range 
of scandalous examples of fraud, waste and abuse at all levels of 
government during a time when the public was initiating tax lim- 
iting legislation, such as "Proposition 13", has caused senior 
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Government officials to place increased emphasis on the impor- 
tance and need to substantially improve internal controls in the 
Federal Government . 

The Comptroller General of the United States has made numer- 
ous statements related to his concern with the inadequacies of 
internal controls in Government and has continuously reemphaaized 
his early conviction that: 

"Our prime concern should be directed toward construct- 
ing systems of management control that will prevent fraud and 
abuse, make it more difficult, and decrease the likelihood of 
error and waste." 

The executive and legislative branches of the Government 
have responded directly and effectively in their resolve to 
substantially improve Government's response to the widely-held 
opinion that internal controls, at all levels of Government, 
require dramatic and timely improvement. Evidence of their 
action has been demonstrated through the passage of Inspector 
General legislation in 1978, with a goal to increase emphasis 
on the prevention and detection of fraud, waste and abuse in 
Government. Also, the establishment by the Office of Management 
and Budget of its Financial Priorities Program in 1979 evidences 
their resolve to improving the accountability structure of all 
executive agencies. That program includes a number of initia- 
tives to improve accounting practices and procedures and basic 
internal controls within agencies and departments. 

The most recent action taken has been the introduction of the 
Financial Integrity Act of 1980 (Act) which has as its primary 
goal providing additional assurances that senior officials in 
Government view their responsibility for internal control systems 
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most seriously. The Act requires that identified system weak- 
nesses receive Congressional and public disclosure until such 
time as effective action is taken to correct them. Accordingly, 
the legislation will necessitate the implementation of effective; 
procedures within agencies and departments to assure the timely 
and continuous monitoring of the effectiveness of their internal 
control systems . 

It is the purpose of this document to provide meaningful 
guidance to senior administrative officials of the Federal Gov- 
ernment, by assisting them: 

o obtain a clear understanding of the scope and objectives 
of the legislation; 

o assess their personal responsibility for assuring their 
organization's compliance with the substance and form of 
the legislation; 

o identify the resources required to achieve compliance; 

and 

o understand how compliance may be achieved with the 
legislation through the performance of meaningful 
evaluations and effective reporting. 

It is expected that providing administrative and program managers 
with a clearer understanding of the meaning and significance of 
internal control systems will foster the achievement of a higher 
level of coordination between them and financial managers in 
achieving compliance with the Act. 

It is important to recognize that the material included 
herein deals principally in what factors to consider and how 
to organize a review to determine the effectiveness of control 
systems. It does not deal directly with the process of assessing 
whether individual controls are effective or inef fective-- 



- iii - 



necessary or unnecceaary. The accounting profession, through its 
organizations and firms, has provided a wealth of information on 
how to evaluate the adequacy of individual controls surrounding 
activities or functions. However, insufficient information is 
currently available to senior executives and managers as to the 
factors to be considered and the organizational steps which 
should be taken to assure timely and accurate feed-back on the 
status and effectiveness of the internal control systems within 
their organizations. Further there is a need for improved under- 
standing of the objectives of internal control systems. 

It should be remembered, however, that even the most well 
designed systems of internal control have inherent limitations. 
They cannot provide absolute assurances that errors, omissions, 
or commissions of improper acts will not occur. Government pro- 
grams which distribute funds or services through intermediary 
Governments or other organizations present additional risks and 
control limitations, since program control effectiveness will be 
dependent upon personnel and systems not totally under the con- 
trol of the sponsoring Federal agency. 



While the Congress and the Public hold Government in general 
accountable for the effectiveness of its systems of internal con- 
trol, the establishment and maintenance of such systems has 
always been the specific responsibility of the heads of Federal 
departments and agencies. The guidance provided herein is 
intended to assist them in executing their responsibilities 
effectively. 
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INTERNAL CONTROLSA BASIC UNDERSTANDING 
The Scope of the Control Review Contemplated by the Legislation 

The Financial Integrity Act of 1980 specifies that the head 
of each executive agency designated by the Office of Management 
and Budget will be required to submit annually, to the President, 
a report on the adequacy of their agency's system of internal 
accounting and administrative controls. The Act requires a 
report on those controls which are designed to provide reasonable 
assurance that the following control objectives are achieved: 

(1) All obligations and costs were in compliance with 
applicable law; 

(2) All funds, property and other assets were safeguarded 
against waste, loss, unauthorized use or misappropria- 
tion; and 

(3) All revenues and expenditures applicable to agency 
operations were properly recorded and accounted for to 
permit the preparation of accounts and reliable finan- 
cial and statistical reports and to maintain accounta- 
bility over the assets. 

Vlhat Are Internal Controls 

Probably the most difficult task in conveying an understand- 
ing of what is meant by the broad term Internal Controls is to 
agree upon a definition which is clearly understood by persons 
who have little or no background in the field of administration 
and financial management. The first question usually raised is; 
How do internal controls relate to accounting systems? Accord- 
ingly, one must first address the complementary relationship 
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between accounting systems and controls before attempting a more 
detailed understanding of factors affecting the quality of 
internal control systems. 

Accounting systems, in a broad sense, include four principal 
components: (1) the system hardware, namely general ledgers and 
their inherent account structures, whether they be in the form of 
manually posted or machine processed records, (2) the assigned 
duties and responsibilities for maintenance of those records or 
the organizational structure adopted, (3) the specific procedures 
to be performed by persons in the execution of their role in the 
accounting process, the procedural controls, and (4) the informa- 
tion system or form of periodic reports which summarize incurred 
financial activity. 

It is a fundamental premise of a sound accounting system 
that the organization of personnel and the specification of pro- 
cedures to be performed should be constructed in such a fashion 
as to preclude any one individual from authorizing, approving 
and executing .financial transactions. This is achieved through 
appropriate "segregation of duties" which results in the assign- 
ment of key control procedures to different persons or different 
organizational elements. 

Internal Accounting Control has been defined by the American 
Institute of Certified Public Accountants as ". . . the plan of 
organization and the procedures and records that are concerned 
with safeguarding of assets and the reliability of financial 
records . . . ." 

In addition to accounting related internal controls, every 
organization will implement a wide spectrum of additional con- 
trols usually referred to as Internal Administrative Controls. 
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Administrative Controls are designed to provide a structure to 
carry out other organizational objectives such as planning, 
productivity, programmatic quality, economy, efficiency, and 
effectiveness. In practice administrative controls and internal 
accounting controls have often been referred to by a number of 
alternative titles and terms. The significance of the title used 
is obviously of less importance than understanding the use and 
role of each such controls within the organization. 

In its Standards for Audit of Governmental Organizations, 
Programs, Activities and Functions, the General Accounting Office 
included both accounting and administrative controls in its defi- 
nition of internal control in Government. Internal Control is 
defined as: 

"The plan of organization and all the coordinate methods 
and measures adopted to safeguard assets, check the 
accuracy and reliability of accounting data, (accounting 
controls), promote operational efficiency, and encourage 
adherence to prescribed managerial policies (administra- 
tive controls) ." 

In performing a review of controls within a Governmental 
organization, it might be considered desirable to review each 
type (accounting and administrative) separately. However, in 
practice this is rarely, if ever, practical since managerial 
decisions in the administrative control area can often have a 
direct influence on the quality and adequacy of accounting con- 
trols, in a simple, but nonetheless effective example, the 
establishment within a unit of Government of administrative 
controls to foster and encourage a high level of supervision 
and review of employee performance can be expected to have a 
significant influence on the quality of employees' execution of 
accounting controls. 



Accordingly, while the presence or absence of specific 
accounting controls can usually be readily determined, a review 
of the adequacy of the overall accounting control system will 
usually necessitate a review of administrative controls to the 
extent that they (1) establish an appropriate accounting control 
environment, (2) influence the nature of internal accounting 
control procedures required, or (3) help to satisfy internal 
accounting control objectives. 

Administrative controls which can influence the control envi- 
ronment generally relate to those such as indicated in the 
example: (1) have an effect upon employees awareness of their 
responsibilities, (2) create a positive organizational attitude, 

(3) act as an incentive to employees to follow procedures, and 

(4) provide reasonable assurance that the failure to perform 
assigned procedures appropriately will result in disciplinary 
action. 

Some administrative control procedures can also have a sig- 
nificant influence on the type of internal accounting controls 
required within the system. For example, an administrative 
decision which permits borrowers under loan programs to make 
payments at regional or district offices will necessitate a dif- 
ferent series o accounting controls than those accompanying a 
system which permits loan repayments to be processed only through 
one centralized processing center. 

Also, as pointed out, the implementation of certain adminis- 
trative controls can strengthen or mitigate the need for account- 
ing controls. The head of a department or agency may institute 
administrative procedures which delegate to program managers the 
responsibility to closely monitor and accept responsibility for 
financial, as well as programmatic activity. It is likely that 
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in the performance of their responsibilities program managers 
will, through their review and inquiry into the appropriateness 
of reported financial results, act as a monitor of the accounting 
system, in these circumstances program managers serve in the 
dual capacity of carrying out both a programmatic (administra- 
tive; and accounting control function. 

In summary the term, Internal Controls, is broad and includes 
both accounting and administrative controls. Controls in either 
the administrative or accounting area are implemented through the 
segregation of key control duties and responsibilities among 
employees and the establishment of specific operating procedures 
which specify the manner in which their functions will be con- 
ducted. Accounting controls deal principally with safeguarding 
assets and the accuracy and reliability of accounting trans- 
actions and reporting. Administrative controls are typically 
designed to encourage adherence to prescribed managerial policies 
and promote operational efficiency. 

While the control evaluation procedure discussed herein is 
not: designed to evaluate administrative controls to assure effi- 
ciency and effectiveness, undoubtedly insights will be gained 
into these areas through this process. Further, it must be 
remembered that the adequacy of accounting controls can often be 
significantly influenced, positively or negatively, by adminis- 
trative controls adopted by the organization. 

As agreed by a wide spectrum of authors on the subject of 
control evaluation ... an understanding of the distinction 
between accounting and administrative controls is useful for 
purposes of obtaining a fundamental knowledge of their interre- 
lationship. However, the importance of the distinction becomes 
less significant if the attention of a control evaluation focuses 
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more appropriately upon the objectives which the organization is 
trying to achieve through the implementation of controls. While 
It might be contended by some that the objectives specified in 
the Act are more closely related to traditional accounting con- 
trols, that observation should not be viewed with significance. 
Rather, it should be the intention of department heads to assess 
the adequacy of both accounting and administrative control sys- 
tems which are designed to achieve the previously listed broad 
objectives of the Act. 

While the use of predetermined detailed checklists which 
identify customary or traditional control techniques can be of 
value, they should be utilized as a tool and not relied upon as 
the sole procedure for conducting control evaluations. 

TheJRe 1 a t ion s hi p B e t we e n b j e c t lye a and Control^ 

There is substantial agreement among professionals that an 
evaluation of a control system must begin with an identification 
of the organization's control objectives. It is assumed that 
management will convert broad control objectives (such as those 
in the Act) which relate to the organization as a whole, into 
specific control objectives for all affected organizational units 
and types of transactions. In most cases there will be a readily 
identifiable relationship between specified control objectives 
and the financial or operational risks against which protection 
is sought . 

Some difference of opinion exists as to whether evaluations 
should be performed on a transactional or organizational (func- 
tional) basis; nevertheless, under either approach specification 
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of meaningful objectives is critical to the successful perform- 
ance of a control evaluation. As an example, while the main- 
tenance of adequate internal accounting controls is an appropri- 
ate overall objective for an executive department, effective 
determination of whether that overall objective is being achieved 
will necessitate the identification and review of numerous sup- 
porting objectives. Such a supporting payroll objective would be 
thatall employee overtime is approved prior to being paid. It 
would be expected that many supporting objectives of this nature 
would be expressed through policy statements or regulations. 

As a further example, dissecting a small portion of one con- 
trol objective specified in the legislation would identify the 
overall organizational objective that: 

"all . . . property . . . (is) safeguarded against . . . 
unauthorized use . . ." 

In most agencies the achievement of that overall objective 
will frequently necessitate the identification of a significant 
number of supporting objectives relating to the often wide vari- 
ety of property which is entrusted to the care of the agency 
and a specification of what, in each case, constitutes unauthor- 
ized use. It is expected that in many cases the necessity to 
identify control objectives will encourage management to address 
and establish positions on a number of issues which may not have 
been previously specified in either Federal regulations or pre- 
vious agency policies. Many times opportunities for fraud, waste 
and abuse are created simply because inadequate attention is 
focused on defining control system objectives and organizational 
policy. 

Once the objectives of a control system are identified, an 
effective evaluation to determine whether they are being achieved 



can commence. The subsequent evaluation will focus upon whether 
or not objectives are being achieved, with little concern as to 
whether the controls relied upon are identified as either 
accounting or administrative controls. 

To assist departments and agencies in the development of 
control objectives applicable to their own organizations, 
Chapter Two contains a discussion and description of the princi- 
pal objectives usually related to frequently encountered func- 
tional areas in Government organizations. 

ADP Considerations 

Most systems involve the uae of Automatic Data Processing 
equipment and systems. The reliability of an ADP system is 
dependent on the adequacy and the emphasis placed on controls 
during the development, installation, maintenance and use of 
the computer equipment and software. System specification and 
design control should be designed to ensure the development 
of effective and adequately controlled systems. Additionally, 
auditability of systems should be addressed throughout all 
aspects of their development. 

How Should Evaluations Be Conducted 

The unique attributes of each Government organization, 
program and administrative function do not lend themselves to 
delineating a single evaluation method. Likewise experience is 
lacking in conducting overall organizational control assessments 
within public as well as in the private sector. Considering 
these factors a model Action Plan to conduct internal control 
evaluations has been developed and is described in Chapter III 
of this guide. The plan is developed in six major steps from a 



description of the head of the department's initial role, to the 
final independent review and opinion by management on the effec- 
tiveness of the department's or agency's control system. 

The Action Plan described utilizes a Project Team approach. 
The intent of the plan is to systematically evaluate existing 
systems from those estimated to have the largest risk potential 
to those with the smallest risk or vulnerability. Since the con- 
trol environment is subject to change, (i.e., personnel com- 
petency, integrity and sufficiency, along with program scope and 
objectives) higher risk areas will require reexamination on a 
more frequent basis. 

Expected Results 

In assessing whether the organization's control objectives 
are reasonably achieved the evaluators of the system will become 
principally involved in a review to determine whether (1) pro- 
cedures adopted are appropriate in the circumstances, (2) key 
duties and responsibilities are properly segregated, and (3) pol- 
icies and procedures are satisfactorily documented, communicated 
and executed. 

Many contend that one of the most important aspects of any 
control system is how effectively individuals perform their 
functions. Consequently, in the performance of a control eval- 
uation, the reviewers should be expected to arrive at a deter- 
mination as to whether persons performing key functions appear 
to be executing their responsibility properly. They will also 
consider whether responsibilities are assigned to an appropriate 
level within the organizational structure. Evaluating whether 
key functions are properly assigned within the organization to 
individuals capable by training and experience to execute them 
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effectively, is of no less importance to the outcome of the 
evaluation than is judging the appropriateness of the procedures 
themselves . 
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IDENTIFYING CONTROL OBJECTIVES 
INTRODUCTION 

The previous Chapter included a discussion of the relation- 
ship between control objectives and control systems and proce- 
dures. It emphasized the importance of obtaining management 
agreement on the objectives of control systems prior to 
commencing a review to determine their adequacy. 

It is highly unlikely that any two Government organizations 
will agree upon a single statement of control objectives. While 
certain similarities may exist, the control objectives of each 
agency would be expected to reflect the differing nature of their 
operations and constituencies, as well as management philosophies 
of the organization. 

It should be stressed that in establishing overall depart- 
mental control objectives, the legislative as well as the pro- 
cedural and specific control objectives, covered in this Chapter, 
should be considered. The detail level of control desired should 
be clearly defined based on a vulnerability analysis or other 
management decisions. 

A number of the texts referred to in the bibliography recom- 
mend that the evaluations be performed on either a transaction 
basis (e.g., cash receipts, disbursements, etc.) or alternatively 
on a functional basis by system (e.g., payrolls, procurements, 
etc.). The selection of either basis appears to be largely a 
matter of personal preference. However, it should be emphasized 
that the common thread among all of the recommended procedures 
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Is Che requirement that objectives of the control system be 
clearly specified and agreed upon prior to implementation of 
the review process . 

The logic of this approach seems clear. Certainly one must 
identify the desired end result before attempting to assess the 
effectiveness of its achievement. In addition, while the methods 
used to achieve certain objectives vary significantly baaed upon 
whether transactions are processed manually or using ADP systems, 
the objectives would nevertheless be expected to remain the same. 

LEGISLATIVE OBJECTIVES 

Financial Integrity Act (Act) 

As mentioned earlier, the executive report required by the 
Act requires annual opinion by the head of an agency as to the 
adequacy of their agency's systems of internal controls. The Act 
states that for these purposes, the general objectives of a sys- 
tem of internal control are to provide reasonable assurances 
that: 

o All obligations and costs were in compliance with 
applicable law; 

o All funds, property, and other assets were safeguarded 
against waste, loss, unauthorized use or misappropria- 
tion; and 

o All revenues and expenditures applicable to agency 
operations were properly recorded and accounted for 
to permit the preparation of accounts and reliable 
financial and statistical reports and to maintain 
accountability over the assets. 

The Act provides further specificity to the previously man- 
dated Internal control responsibility of the heads of agencies 
established by the Budget and Accounting Act of 1950. 
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Budget and Accounting Act of 1950 

The 1950 Act places responsibility for establishing and main- 
taining adequate systems of internal control upon the head of 
each executive agency. It also prescribes that accounting sys- 
tems conform to the accounting principles, standards, and related 
requirements prescribed by the Comptroller General of the United 
States and that the systems be approved by him. 

Accounting systems are considered an integral part of inter- 
nal control systems. The 1950 Act defined the general objectives 
which each agency's accounting system should provide. These are: 

o Full disclosure of the financial results of agency 
activities; 

o Production of adequate financial information needed for 
agency management purposes; 

o Effective control over the accountability for all funds, 
property, and other assets for which each agency is 
responsible; 

o Reliable accounting results to serve as the basis for 
preparation and support of agency budget requests, for 
controlling the execution of the budgets, and for 
providing financial information required by the Office 
of Management and Budget; 

o Suitable integration of agency accounting with the 
control accounting; and 

o Reporting operations of the Treasury Department. 
COMMON CONTROL TECHNIQUES AND SPECIFIC CONTROL OBJECTIVES 

Assuring adequacy of controls and compliance to prescribed 
control procedures through an annual evaluation is necessary to 
provide an agency head with a basis for the required annual 
report to the President. The transaction systems or functions 
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usually found in Government organizations which will require 
evaluation are: 

Overall Functions and Activities 

--accounting and reporting 
--automatic data processing 

Payment Functions and Activities 

--payroll 

--contracts 

--grants 

--loans and loan guaranty 

--pensions 

--travel 

--payables 

Collection Functions and Activities 

--accounts receivable 
--collections 

Other Functions and Activities 

--cash and negotiable instruments 

--letters of credit 

--capital assets and material inventories 

It should be recognized that even within the functional areas 
identified, it will usually be appropriate for agencies to spe- 
cify control objectives to a subfunctional level. As an example, 
it would usually be practical to separately specify objectives in 
t ^ ie contracts area to the sublevel of tangible property contract- 
jjig and personal service contracts. Similarly it may be appro- 
priate to further specify objectives in the grants area based 
upon the nature of recipients such as colleges and universities 
and other not-for-profit .civic organizations. While there is no 
right or wrong answer as to the depth or level to which objec- 
tives should be specified, as a general rule, it is expected that 
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objectives be specified to the same level that controls are 
expected to be implemented. 

The remainder o this chapter will be devoted to a discussion 
of (1) common control techniques applicable to all systems, fol- 
lowed by (2) an identification of specific control objectives 
associated with the previously identified transaction systems, 
functions or activities. 

COMMON CONTROL TECHNIQUES 
Documentation 

If controls are expected to operate effectively it is 
essential that control procedures, policies, authorities and 
responsibilities be clearly and adequately documented. Once 
documented they should be available to personnel Involved in 
their execution. Documentation usually takes the form of opera- 
tions manuals and organization charts which describe and depict 
the role and responsibilities of all individuals engaged in the 
control system. Not only does proper documentation provide 
assurances that the method of, and responsibility for, following 
procedures is clearly communicated it is often a valuable tool in 
training new employees. 

Segregation of Duties 

A basic tenet of a sound internal control system is that no 
individual or small group of individuals should be in a position 
to control all aspects of a transaction. Responsibilities should 
be segregated and tasks should be structured to pr-eclude them 
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from performing more than one "key" processing function or activ- 
ity, such as authorizing, approving, certifying, accounting, and 
disbursing. 

Supervision 

Effective systems of internal accounting and administrative 
control require strict adherence to procedures and practices . 
Qualified and continuous supervision is necessary to asisure 
agency management that desired procedures are being applied to 
safeguard the resources of the agency. 

g e c ur i t y o f P rop e r t y an d^R e c o r d s 

The preservation and safekeeping of property and records of 
the Government is important to the prevention of their loss or 
misuse. Generally, procedures should include physical security 
of accounting records, negotiable instruments or securities, and 
other assets of the agency. Accordingly, procedures should be 
employed to ensure that appropriate recordkeeping and archival 
procedures exist and are followed. 

Internal 



An internal audit or review function should be organized to 
continuously monitor policies, procedures, and practices related 
to all fiscal and accounting activities. Where appropriate 
reviews should include examining and testing of transactions , 
Also, procedures should exist to assure followup of audit find- 
ings and recommendations, and to assure timely corrective action 
by management . 
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Competency of Personnel 



Personnel should be competent, by education, training and 
experience, to execute the control responsibility to which they 
are assigned. Unless personnel are technically qualified Co 
execute the responsibilities of the positions they hold, agency 
heads cannot expect the effective execution of control polIcieB, 
procedures and practices. 

SPECIFIC CONTROL OBJECTIVES 

The following represent control objectives associated with 
the previously identified transaction systems or functions which 
should be considered in performing a control evaluation. As 
previously noted these objectives must, of course, be tailored to 
the unique control requirements of each agency and its 
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e. Accounting systems are submitted for timely approval to 
the Comptroller General. Timely action is taken to 
identify and resolve matters preventing approval. 

f. Administrative controls are submitted for timely 
approval by Office of Management and Budget. Timely 
action is taken to identify and resolve matters 
preventing approval. 

g. Timely and periodic reconciliations are made to ensure 
that subsidiary records are in agreement with general 
ledger balances. 

h. Timely and periodic reconciliations are made of agency 
cash account balances with those of the Department of 
the Treasury, 

i. Timely and periodic comparisons of budget and actual 
expenditures are made and significant variances 
analyzed. 

j . Temporarily undistributed expenditures are properly and 
timely distributed to proper accounts . 

Automatic Data Processing 

a. Systems provide for proper authorization of transaction 
input, adequate edit checks and necessary safeguard of 
sensitive input forms to insure accurate, proper, 
complete and timely entry of information. 

b. Data are safeguarded to prevent unauthorized access, 
improper changes or loss. 

c. Controls include: (1) appropriate operational logs to 
detect unauthorized use of the system; (2) operating 
instructions providing adequate information to operators 
on a "need to know" basis; O) new programs and changes 
to existing programs are specifically authorized; and 
(4) appropriate change control procedures . 

d. Systems produce intended outputs accurately, completely 
and timely. 



Payroll 



Appropriate authority is established and documented for 
the appointment, change, and termination of all 
personnel. 
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f. Grantees implement sound organizational, budgetary and 
accounting systems that are periodically reviewed and 
evaluated. 

g. Grantees assure that Government-financed property and 
equipment are properly accounted for, inventoried, 
safeguarded and maintained. 

h. Prompt and appropriate grant close-out actions are 
taken. 

Loans and Loan Guaranty 

a. Applications for loans and loan guaranty are evaluated 
for appropriateness of eligibility, collateral, and 
other qualifying criteria prior to approval. 

b. Title to property used as collateral is properly 
recorded, filed, and secured by a responsible custodian. 

c. Periodic aged reports of loan balances due are prepared, 
reviewed and timely collection action taken. 

d. Loan and loan guaranty repayments are collected, con- 
trolled and reported in a manner that is consistent with 
the applicable appropriation or other public law. 

e. Periodic estimates are made of uncollectible loan 
balances . Such estimates are timely reported to 
management . 

f. Proper write-off, conversion, and settlement or 
forgiveness of delinquent loans is assured. 

Pensions 

a. Files are maintained for each recipient containing 
evidence of eligibility and approval and computation of 
original and subsequent changes to payments. 

b. Recipients are made aware of their personal 
responsibilities for continuance of payments. 

c. Benefits paid to survivors or beneficiaries are subject 
to the same controls as other payments. 
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Travel 



a. 



disbursements 
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c. Timely follow-up and collection are made of all amounts 
due to the Government and all procedures for effecting 
collection, including offset and installment payments, 
are utilized. 

Cash and Negotiable Instruments 

a. Physical security safeguards are maintained where cash 
and negotiable instruments are stored and processed. 

b. The following items are protected from unauthorized use; 



Cash; 

Check signing machines; 

Signature dies; 

Blank checks, bonds, drafts and other securities; 

Partially prepared checks and bonds; and 

Mutilated or voided checks and bonds. 



All receipts are properly recorded and deposited 
promptly. 



Letters of Credit 



c. 



d. 



Letters of credit are issued only to large dollar 
recipients who have a continuing relationship with the 
Federal Government and have an adequate cash management 
system. 

Amounts available under letters of credit are con- 
strained to assure they do not exceed available award 
authority; monthly limits on drawdowns are established 
based on cash flow needs . 

Drawdowns from letters of credit are monitored to assure 
recipients do not draw in excess of current needs. 

Expenditure reports are required and compared to program 
reports to assure funds are used for their intended 
purpose. 



Capital Assets and Material Inventories 

a. The distinction between a capital and operating expendi- 
ture is clearly identified for accounting purposes. 

b. Only authorized and needed property is ordered. 

c. All receipts of property are timely and accurately 
recorded in source documents and accounting records. 
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d. Detailed subsidiary records are maintained for individ- 
ual capital assets and significant categories of mate- 
rial inventories; these are periodically reconciled to 
control accounts . 

e. Periodic physical verification is made of the existence 
and condition of property and Inventories . 

f. Physical counts of property and inventories are reliable 
(i.e., accurate, complete and timely) and accounting 
records are adjusted accordingly. 

g. Physical security measures are commensurate with the 
size, type, and value of property. 

h. All issues, transfers, retirements, losses, and other 
variances are timely reported and accounted for. 
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III 

ACHIEVING COMPLIANCE WITH THE FINANCIAL 
INTEGRITY ACT (ACT) 

The Act (Appendix A) requires each department or agency head 
to express annually an opinion on the adequacy of their organiza- 
tion's system of internal controls. To comply with this require- 
ment, each department or agency will need to develop an Action 
Plan to conduct continuous internal control evaluations which 
will form the basis for the annual opinion or report. 

This Chapter discusses one systematic approach to organizing 
and performing a successful control evaluation. Appendix B pro- 
vides a bibliography containing references to a number of other 
publications that outline alternative approaches. 

The factors to consider in developing an Action Plan are 
described in six phases, as follows: 

o Planning and Organizing the Evaluation Process; 

o Establishing the Steering Committee; 

o Formulating Key Evaluation Policies ; 

o Assigning Project Director Responsibilities; 

o Reporting by the Project Teams; and 

o Reporting by the Steering Committee. 

The principal Action Plan participants and their overall 
roles are: (1) the head of a department or agency who must 
initiate the development of the Action Plan, give it policy 
direction, and be accountable for its results; (2) a Steering 
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Committee that is composed of senior members of the organiza- 
tion's major staff and operating components, converts the head 
of the department's or agency's broad policies into measurable 
goals, and provides policy guidance to Project Teams who are 
charged with performing the actual control evaluations; (3) Proj- 
ect Teams chosen from the organization's major operating compo- 
nents to perform control evaluations of assigned activities or 
functions; (4) a Project Team Director, who supervises the 
activities of the Project Teams in their performance of control 
evaluations; and (5) the Inspector General or Director of Audit 
who furnishes advisory assistance and separately reports on 
internal control matters as part of their normal surveillance 

process. A typical Control Evaluation Project is depicted in the ti 

accompanying flow chart in Figure 1. 

cu 

PLANNING AND ORGANIZING THE EVALUATION PROCESS O 



Senior management officials should implement the intent of 5 

the Act through careful planning, close supervision, and con- -3 

tinuing support. What is done and when, who is responsible, and "c 

what resources are to be applied to achieve control evaluation O 

objectives are fundamental considerations. The Action Plan 
leading to the evaluation process should be important enough to 
be included in management's overall operating plans. 

The Action Plan may provide for multi-year execution, since 
all significant functions and activities may not require or be 
able to be evaluated annually. Additionally, since programs and 
activities are subject to change or restructuring, the Action 
Plan should be sufficiently flexible so as to be able to accom- 
modate changed circumstances by allowing adjustments to the eval- 
uation process . 
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Figure 1 
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The authority to conduct a control evaluation should be 
delegated from the agency head to a Steering Committee charged 
with the responsibility to prepare the Action Plan and oversee 
the conduct of detail control evaluations. To establish the 
proper environment for conducting the evaluation, the department 
or agency head should communicate to all principal staff member., 

Han re"?" " the lntent and *y Provisions of the Action 
Man and the Steering Committee's responsibility and role. 
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5. Intern.! review, audit, or Inspector General activities; 

6. Automatic data processing. 
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The Steering Committee should establish management's defined 
level of acceptable risk. That is the point beyond which manage- 
ment is not willing to (1) tolerate loss of assets and revenues; 
(2) accept a margin of error in reports and information; (3) per- 
mit illegal or unethical acts; and (4) sustain adverse public 
opinion. 

Identifying the acceptable level of risk within elements of 
the organization will be a key factor in determining the activi- 
ties to be evaluated and the extent or scope of the review to be 
conducted . 

The Vulnerability Assessment Grid in Figure 2 is one example 
of how program function or activity risk can be assessed and 
documented. The Grid consists of four designated levels or quar- 
tiles of control vulnerabilityHigh, Limited, Moderate, and 
Little. Those factors which are considered to impact vulnerabil- 
ity are listed in each level,, modified by a qualitative descrip- 
tion appropriate to each level of vulnerability. Each factor is 
graded for the activity or function being evaluated by identify- 
ing the quartile description which most clearly characterizes 
that aspect of the function or activity. Finally, the Risk 
Point Value assigned to each factor is totaled and compared to 
other activities to establish relative vulnerability. The levels 
of vulnerability, designed factors, and grading system can be 
altered to suit the judgments of each department or agency 
Steering Committee. 

, 2< - Establlsh Policies and Stan^H. ^ Steerl 
Committee should formulate policies or standards which will guide 

performance - At * mi ******* 
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Figure 2 
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a. Working paper documentation standards to be 
used in conducting evaluations. 

b. Performance standards and guidelines including 
the appropriate use of testing techniques such 
as statistical sampling, simulation and model- 
ing, processing of fictitious transactions, 
etc. 

c. The appropriate use of the reports of 
independent third parties on internal control 
and related matters. 

d. Materiality guidance for purposes of 
establishing reportable control weaknesses. 

e. Guidelines for the reporting of weaknesses to 
line management and subsequent follow-up to 
assure timely corrective action. 

3. Defining Personnel Requirements . Project success 
will greatly depend upon the quantity and quality of staff 
resources available to perform the evaluation. One o the 
Steering Committee's principal responsibilities should be to 
establish preliminary time goals for the completion of the evalu- 
ation and the identification of staff resources needed to support 
the Action Plan. The Committee should also be responsible for 
securing a management commitment to provide the required manpower 
resources neceessary to meet established time goals. 

To supplement assigned Project Team personnel, operating 
management of the program functions or activities being evalu- 
ated can be invited to participate in the conduct of evaluations. 
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The principal reasons for incorporating operating management 
representatives in the evaluation process is to: (1) add 
increased insights and perspectives into the areas being eval- 
uated; (2) strengthen managerial commitment to the project; 
and (3) promote acceptance of the evaluation results and timely 
correction of weaknesses. 

The Committee should also address those circumstances in 
which it is considered appropriate to use outside consultants or 
experts in such areas as ADP, engineering, financial, legal, 
personnel , insurance , procurement , statistics , and economics . 

Closely related to resource policy issues is the appropriate 
use of internal audit or Inspector General staff. In most cir- 
cumstances kthey should be limited to an advisory role. 

4. Documenting and Communicating Responsibilities^ . 
To achieve a successful, complete, orderly, and timely evalua- 
tion, the roles and responsibilities of each participant must be 
clearly stated and understood. This includes those of the Steer- 
ing Committee, Project Teams s the Project Team Director and other 
participants. Their authorities and responsibilities should be 
formally documented. In addition, the goals and objectives of 
the Action Plan should be formalized in writing, approved by the 
agency or department head, and communicated throughout the organ- 
ization. Line management support for the control evaluation 
effort is critical to achieving success and is predicated largely 
on their understanding of its goals and objectives. Further, 
program and administrative elements of the organization will be 
asked to cooperate with Project Team efforts and contribute staff 
resources to the evaluation. Their clear understanding of man- 
agement support for the project will provide assurances of their 
continuing support and cooperation. 
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ASSIGNING PROJECT DIRECTOR RESPONSIBILITIES 

Planning, executing, evaluating and preparing timely reports 
on a series of diverse internal control evaluations requires sig- 
nificant organization. 

Project Teams should be formed under the direct supervision 
of a Project Team Director to conduct the individual program or 
activity evaluations specified by the Steering Committee. The 
Project Team Director will be the focal point for: (1) planning 
assigned evaluation projects; (2) assigning project priorities, 
as well as specific evaluation tasks; (3) assuring compliance 
with standards and guidelines established by the Steering Com- 
mittee; (4) arranging for manpower and logistical support; 
(5) acting as the senior spokesperson in dealing with manage- 
ment of the functions or activities being reviewed; (6) evalu- 
ating Project Team results; and (7) preparing reports to the 
Steering Committee. 

It is likely that several different functions or activities 
will be reviewed simultaneously by different Project Teams. 
Accordingly, to assure that project staff is used effectively, 
sound project management techniques should be used. Project 
phases should be defined with fix.ed time goals and required 
interim progress reports. Milestone charts, baseline planning 
schedules, and PERT charts for large complex reviews are useful 
tools in monitoring activities of this nature. 

REPORTING BY THE PROJECT TEAMS 

At the conclusion of a Project Team's evaluation of internal 
controls within an assigned function or activity, it will prepare 
a report summarizing the results of its findings. The report is 



expected to summarize major control weaknesses identified and 
the reaction of operating management to the issues and recom- 
mendations presented. It would also be appropriate to comment 
in the report on the extent to which other compensating or 
alternative controls could be relied upon to mitigate any weak- 
nesses identified. 

The report should suggest the extent of efforts and resources 
estimated to be involved in correcting reported weaknesses, an 
estimate of the cost benefit relationship of recommended control 
enhancements , a suggested time frame for implementation of recom- 
mendations, and the extent and degree of cooperation received in 
conducting the review. The responsiveness of management of the 
function being evaluated to weaknesses reported in a previous 
evaluation or by other evaluators , such as the Inspector General, 
should also be included. 

The Project Team Director will review each report and its 
conclusions with the Project Team and management of the affected 
activity. This may be accomplished through participation in the 
Project Team's exit conference. The Project Director will add 
to the report any clarifying or amplifying information deemed 
appropriate and schedule the report for review by the Steering 
Committee. 

REPORTING BY THE STEERING COMMITTEE 

Although not limited in its communications, the Steering 
Committee must of necessity submit at least one report annually 
to the head of the department or agency. This report, together 
with the results of personal discussions with the Steering Com- 
mittee, will usually form the primary basis for the agency or 
department head's report to the President. Accordingly, the 
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annual Steering Committee report must include: (1) an identi- 
fication of the reviews conducted during the year; (2) a summary 
of the results of those reviews; (3) the Steering Committee's 
recommended action, where management disagrees with the necessity 
for recommended control improvements; and (4) an estimate of 
resources needed to effect improvements and associated cost ben- 
efit considerations. Most importantly the Steering Committee 
will recommend the nature and form of report to be issued to the 
President by the head of the agency. Further discussion o the 
content of such a report is included in the following chapter. 
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IV 
REPORTING 

The Annual Report of the Chief Executive of Departments or 
Agencies 

The Act requires the head of each executive agency designated 
by the Office of Management and Budget, beginning in 1981, to 
prepare an annual report on the adequacy of the agency's systems 
of internal accounting and administrative control. The report 
must be submitted to the President and shall also be available to 
the Congress and the Public. 

The purpose of the report is to provide the Congress and 
central policy agencies with an awareness of the adequacy of 
control systems in departments and agencies throughout the 
Federal Government. Internal accounting and administrative 
control systems have always been the primary responsibility of 
management and they have been the subject of auditors' reviews. 
However, the passage of the Act demonstrates the Increasing 
concern of the Congress and the Public with maintaining an 
awareness of the status of control systems and their conviction 
that effective control systems contribute to better Government. 

It is expected that the reporting requirement will direct 
increased management attention to the importance of controls. 
Managements will henceforth be required to assess their agency's 
Internal control systems by making a critical evaluation of their 
adequacy before preparing required annual reports. 
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Suggested Content of Agency Reports on Controls 

Under the Act, the Director of the Office of Management and 
Budget (OMB), in consultation with the Comptroller General, is 
required to establish the exact form of reporting to be used by 
agency executives and provide a general framework to guide them 
in performing evaluations of systems of internal accounting and 
administrative control. However, it is expected that a signifi- 
cant degree of reporting discretion shall be permitted, In which 
case consideration should be given to the following matters . 

The Act states that an adequate system of internal accounting 
and administrative control should provide reasonable, not abso- 
lute, assurance that the following objectives are achieved: 

o All obligations and costs were in compliance with 
applicable laws; 

o All funds, property, and other assets were safeguarded 
against waste, loss, unauthorized use, or misappropri- 
ation; and 

o All revenues and expenditures applicable to agency 
operations were properly recorded and accounted for 
to permit the preparation of reliable financial and 
statistical reports and to maintain accountability over 
assets . 

Management's report on its systems of internal control 
should, therefore, address whether in their opinion the systems 
appear to provide reasonable assurance that these objectives were 
achieved during each fiscal year. In this regard the report 
should include management's acceptance of primary responsibility 
for the adequacy of internal accounting and administrative con- 
trols. 
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If no material weakness has been identified by management 
during its ongoing evaluation of controls, an unqualified opinion 
concluding that systems provide reasonable assurance of achieving 
control objectives specified by the Act can be expressed by man- 
agement. If, however, a review discloses material control system 
weaknesses which indicate all control objectives may not be com- 
pletely achieved, management would be precluded from expressing 
an unqualified opinion. The report should in these circumstances 
identify the material weaknesses which prevent the systems from 
completely achieving their objectives and describe management's 
plans for correcting these weaknesses. 

Management should include in Ita report any explanation on 
unresolved findings on internal controls disclosed in internal 
or external audit reports. Such disclosures should describe the 
corrective action being taken or contemplated with target dates 
concerning uncorrected material weaknesses identified in the 
audit reports . 

Management may also describe the extent of efforts it has 
undertaken to comply with the Act. Such description, for 
example, may include a discussion of the plans adopted to perform 
ongoing evaluations of internal accounting and administrative 
controls and the progress made in completing their implementa- 
tion. 

In addition, management's report should include a descrip- 
tion of the status of GAO approval of its accounting system 
design and, where appropriate, plans for achieving approval 
status. It should be recognized, however, that GAO's review and 
approval of executive agency accounting system designs involves 
an initial evaluation of internal accounting controls which will 
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require periodic reevaluations by the agencies after implementa- 
tion. 

Consideration should also be given to describing the status 
of OMB approval of administrative controls and fund procedures. 

Inspector General or Internal Auditor Reporting 

Inspectors General, as part of their currently required 
semiannual reports to the Congress, are expected to summarize any 
findings, opinions, conclusions or recommendations they may have 
regarding the internal accounting and administrative controls of 
their agency. For those agencies without an Inspector General, 
the head of the internal audit department should be expected to 
prepare a similar report to the head of their department or 
agency. In addition, Inspectors General and Internal Auditors 
are required by the Act to receive, investigate and report any 
allegations that agency employees have provided false or mis- 
leading information in connnection with the agency's evaluation 
of its control systems. The reporting responsibilities of the 
Inspector General and agency head are expected to be complemen- 
tary, not redundant. 

Director of OMB Reporting 

After receipt of the Executive reports from departments and 
agencies the Director of OMB is expected to summarize their con- 
tents. This summarization will provide an overview of the con- 
trol environment in the Federal Government as a whole and is 
expected to provide the President and the Congress with a plan 
and timetable for correcting any reported material weaknesses of 
the control systems in the Government. 
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OTHER EVALUATION CONSIDERATIONS 
The Importance of the Control Environment 

In the earlier discussion of controls, it was pointed out 
that administrative controls are largely responsible for estab- 
lishing the control environment or control consciousness of an 
organization. In the discussion of the types of administrative 
controls which are responsible for creating the control environ- 
ment, it was pointed out that generally they are the types of 
controls which (1) influence the degree of employee awareness of 
their individual responsibilities, (2) their impression of man- 
agement's attitude toward maintaining an appropriately controlled 
environment, and (3) their perceptions of the discipline which 
exists within the organization. In short, their perception of 
whether failure to comply with controls will result in appropri- 
ately measured disciplinary action. 

It is widely accepted that the most influencing factor on 
the credibility of an organization's control system, be it either 
accounting or administrative, is the state of its control envi- 
ronment. It is a frequent impression that Government often fails 
to create an appropriate control environment within its organiza- 
tional units that has led to fraud, waste and abuse. Because of 
the importance ascribed to this area by both professionals and 
the Public, additional comments appear particularly warranted. 

A special advisory committee on internal accounting control 
organized by the American Institute of Certified Public Account- 
ants concluded that "an overall evaluation of an organization's 
internal accounting control environment is a necessary prelude 
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to the evaluation of control procedures and techniques." The 
committee stated further that: 



... a poor control environment would make some 
accounting controls inoperative for all intents and 
purposes; for example, individuals would hesitate to 
challenge a management's override of a specific control 
procedure. On the other hand, a strong control environ- 
ment, for example, one with tight budgetary controls and 
an effective internal audit function, can significantly 
complement specific accounting control procedures and 
techniques," 

The committee identified a number of factors which they 
believed to be important to the development of appropriate atti- 
tude, awareness, and discipline within an organization. They 
included: 



Organizational Structurethe establishment of appropri- 
ate reporting relationships, identification of functions 
to be performed by organizational units, and the estab- 
lishment of authority, responsibilities, and constraints 
of key positions; 

Personnel- -the competence and integrity of the organiza- 
tion ' ^personnel ; 

Delegation of Authority and Communication of ^Respon- 
sibility- -appropriate delegation or limit at lon^of 
authority in a manner that provides assurance that 
responsibilities are effectively discharged; 

Budgets and Financial Reportsformulation and com- 
munication of organizational goals through appropriate 
levels of budgeting and financial reporting; 

Organizational Checks and Balancesthe establishment of 
an appropriate level of financial control and internal 
auditing; and 

ADP Considerationwhen utilized, an awareness of the 
strengths and exposures inherent in such an installation 
and the implementation of controls to give recognition 
to their existence. 
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While the importance of these individual areas cannot be 
disputed, it remains that the single most determinate factor 
surrounding the implementation and maintenance of an adequate 
control system is the "attitude" of senior management of the 
department or agency toward the importance of controls. Atti- 
tudes will not only affect the quality of employee performance, 
but also the quality of accounting, EDP and reporting systems, 
all of which dramatically influence organizational and pro- 
grammatic effectiveness. If management demonstrates a lack of 
interest in development and maintenance of an appropriate con- 
trol environment or contributes to its deterioration through 
indifference, a control system will quickly deteriorate into 
ineffectiveness. This is also the likely result if management 
does not implement an appropriate control monitoring procedure 
through the use of an effective internal audit process, periodic 
management review, or an appropriate combination thereof. 

The importance of the monitoring process cannot be overem- 
phasized. It must be remembered that most control systems are 
not self-correcting. If control failures occur and no monitoring 
process is in place to detect their occurrence, the failure might 
be disclosed only by the detection of a subsequent fraud. Fur- 
ther, the activities of large government departments are dynamic. 
A control system to be effective must be responsive to changing 
conditions. And lastly, control systems are heavily dependent 
upon effectiveness of people and their basic competence and 
honesty, their adequacy in number and their supervision. The 
frequent high rate of change of job assignments in Government 
places special emphasis on the necessity for an effective and 
continuous monitoring process as a check on the maintenance of 
a high level of control compliance and execution. 
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Organizational Responsibilities 

It is a frequent misconception in the Government that con- 
trols are the exclusive domain of the accounting or finance 
areas of the organization. Or even more disconcerting, that pro- 
grammatic objectives and controls and accounting controls should 
be evaluated on a mutually exclusive basis. Effective execution 
of accounting and reporting activities requires the coordination 
and cooperation of all segments of the organization, be they 
administrative, programmatic or financial. The quality of the 
control environment and the control system, and the public's 
perception of the level of accountability achieved by the organ- 
ization are totally dependent upon the coordination of adminis- 
trative, programmatic and financial personnel. 

Symptoms of Control Deficiencies 

Experience has indicated that the existence of one or more 
of the following danger signals will usually be indicative of a 
poorly maintained or vulnerable control system. These symptoms 
may apply to the organization as a whole or to individual depart- 
ments or activities. Newly appointed chief executives usually 
place a high priority upon a personal evaluation of these areas, 
because they usually dictate the quality of operational, as well 
as financial, control exercised by the organization. These 
danger signals include: 

o A clear statement does not exist for standards of 
employee ethical conduct; 

o Policy and procedural or operational manuals are either 
nonexistant or are not currently maintained; 

o Lines of organizational authority and responsibility are 
not clearly articulated or are nonexistent; 
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o Financial and operational reporting is not timely and is 
not utilized as an effective management tool; 

o Line supervisors ignore or do not adequately monitor 
control compliance; 

o No procedures are established to assure that controls in 
all areas of operation are evaluated on a reasonable and 
timely basis; 

o Internal control weaknesses detected are not acted upon 
in a timely fashion; and 

o Controls and/or control evaluations bear little rela- 
tionship to organizational exposure to risk of loss of 
resources . 

Care should be exercised by all organizations to assure that 
these symptoms or danger signals, if present within the organiza- 
tion, are not permitted to continue unabated. 

A number of efforts are taking place within the Public and 
Private Sectors to identify other symptomatic areas of weakness 
usually associated with inadequate control systems. The AICPA's 
Standing Committee on Methods, Perpetration and Detection of 
Fraud as well as others have identified and published lists of 
conditions which often signal fraud opportunities. One of the 
primary objectives of the Task Force on Prevention of Fraud, 
Waste and Abuse in Government, organized by the Comptroller Gen- 
eral of the United States, has been to study, classify and pub- 
lish information dealing with those organizational or control 
factors which have contributed to previously disclosed acts of 
fraud, waste and abuse in the Government. These sources can 
provide valuable input to persons organizing and conducting 
control reviews. 



1. Management Accounting, Red Flagging the White Collar Crime 
Wave, 1980, Marshall B. Romney, W. Steve Albrecht and David J. 
Cherrington. 
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Limitations Inherent in Control Systems 

Insofar as accounting control systems are concerned, the 
accounting profession has always recognized that, at best, sys- 
tems can only be expected to provide reasonable assurance that 
their objectives are achieved. Consequently, no system should 
be implemented without giving effect to cost/benefit considera- 
tions. Whether it be in the initial development of a control 
system or consideration of system enhancements, controls should 
not be implemented unless a reasonable cost/benefit relationship 
can be established. Of course, it should be recognized that not 
all factors bearing on cost/benefit decisions can be reduced to 
monetary terms and, accordingly, certain decisions will entail 
the use of considerable subjective judgment. 

The American Institute of Certified Public Accountants has 
identified four other limitations of any system of internal 
accounting control. These limitations are generally stated in 
the following terms: 

can t rts!at f f rmanC:e f m St contro1 Procedures, errors 
takes of judgment, carelessness! or other^ersSnarfac- 

r-M P ? C J d I?F e8 whos , e effectiveness depends upon see- 
regation of duties can be circumvented by collusion; 

recor^ln r^ e ? Ure8 w jf h res P ect to the execution and 
Xthlr e?r J aCtlons ? a ? be ineffective against 
ment or fnS ^regularities perpetrated by raanage- 

aSement ^ a P ro P rlate estimates and judgments by man- 
agement in the preparation of financial statements; and 
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Projection of Che adequacy of current Internal account- 
ing controls to future periods is subject to the risk 
that controls may become inadequate due to changes in 
conditions or due to the fact that compliance with 
control procedures may deteriorate. 

It should be remembered that no system of internal control is 
perfect and the need for controls is ever changing. Factors such 
as cost/benefit, reasonable assurance, and the other practical 
limitations inherent in control systems require managements and 
the reviewers of control systems to maintain a constant awareness 
of system limitations as well as organizational vulnerability and 
risk. Additionally, reviews of control systems should not only 
focus on apparent weaknesses but should also give attention to 
instances of control excesses. The need in the Government is not 
necessarily for more controls, but better controls. 



- 47 - 



APPENDIX A 

FINANCIAL INTEGRITY ACT 
A BILL 



To amend the Accounting and Auditing Act of 1950 to require 
ongoing evaluations and reports on the adequacy of the systems of 
internal accounting and administrative control of each executive 
agency. 

Section 1. Short Title. 

This Act may be cited as the FINANCIAL INTEGRITY ACT of 1980. 

Section 2. (a) Findings. 

The Congress hereby finds that: 

(1) Fraud, waste, and mismanagement have caused a serious 
crisis of confidence in Federal government programs and 
agencies . 

(2) Fraud and errors in Federal programs are more likely to 
occur from a lack of effective systems of internal 
accounting and administrative control in the Federal 
agencies . 

(3) Effective systems of internal accounting and 
administrative control provide the basic foundation upon 
built a Structure of P ub lic accountability must be 

(4) Effective systems of internal accounting and 
administrative control are necessary to provide 
assurance that Federal assets and funds are adequately 

? S TO 1 1 as to P roduce reliable financial 
for the agency. 



(5> f lnternal accounting and administrative 

; n S e Sarlly dynami ? and must be continuously 
and where necessary improved. 



(6) Reports regarding the adequacy of the systems of 

internal accounting and administrative control of each 
Federal agency are necessary to enable the Executive 
Branch, the Congress and the public to evaluate the 
agency's performance of its public responsibilities and 
accountability. 

(b) Policy. 

It is hereby declared to be the policy of the United States 
that: 

(1) Each Federal agency must maintain effective systems of 
internal accounting and administrative control as an 
integral part of its management practices. 

(2) The systems of internal accounting and administrative 
control of each Federal agency shall be evaluated on an 
ongoing basis and when detected, weaknesses must be 
promptly corrected. 

(3) All levels of management of the Federal agencies must 
involve themselves in assessing and strengthening the 
systems of internal accounting and administrative 
control to minimize fraud, errors, abuse, and waste of 
government funds . 

Section 3. As used in this Act: 

(a) The term "President" means the President of the 
United States. 

(b) The term "Comptroller General" means the 

Comptroller General of the United States. 

(c) The term "Director" means the Director of the 
Office of Management and Budget. 

Section 4. 



Section 113 of the Accounting and Auditing Act of 1950, as 
amended (31 U.S.C. 66a) , is amended by adding at the end thereof 
the following new subsection: 
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(d) (1) To ensure that the requirements of subsection (a) (3) 
of this section are fully complied with, the head of each 
executive agency which the Director determines to be covered by 
this subsection, shall prepare a report stating an opinion on the 
adequacy of the agency's systems of internal accounting and 
administrative control by December 31, 1981, and by December 31 
following the end of each fiscal year thereafter. 

(2) The reports shall be signed by the head o each 
executive agency and addressed to the President. Such reports 
shall also be made available to Congress and the public. 

(3) By December 31, 1980, the Comptroller General in 
consultation with the Director shall establish a system of 
reporting and a general framework to guide the agencies in 
performing evaluations on their systems of internal accounting 
and administrative control. The Comptroller General, in 
consultation with the Director, may modify the format for the 
report or the framework for conducting the evaluations from time 
to time as deemed necessary. 

(4) Internal accounting and administrative controls are to 
be defined by the Comptroller General, and shall provide 
reasonable assurances that: 



C StS Were in compliance with 
(ii) All funds property, and other assets were 
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reports and to maintain accountability over the 

assets. J 

Any inadequacy or material weaknesses in an agency's systems 
of internal accounting and administrative control which prevents 
the head of the agency from stating that the agency's systems o 
internal accounting and administrative control provided 
reasonable assurances that each of the objectives specified above 
were achieved shall be identified and the plans and schedule for 
correcting any such inadequacy described in detail. 

(5) (a) The Inspector General of an executive agency or, if 
no Inspector General exists for an agency, the head of the 
internal audit staff, shall receive and investigate any 
allegation that an employee of the agency provided false or 
misleading information in connection with the evaluation of the 
agency's systems of internal accounting and administrative 
control or in connection with the preparation of the annual 
report on the systems of internal accounting and administrative 
control, 

(b) If in connection with any investigation under 
subparagraph (a), the Inspector General or the 
head of the internal audit staff, as appropriate, 
determines that there is reasonable cause to 
believe that false or misleading information was 
provided, he shall report that determination to the 
head of the agency. 

(c) The head of the agency shall review any matter 
^JST^ hi "! under 8ub Para g raph (b) and shall 
take action under Chapter 75 of Title 5, United 
btates Code, or such other disciplinary or 
corrective action as he deems neceassary. 



- 51 - 



APPENDIX B 
BIBLIOGRAPHY 

REPORTS AND PUBLICATIONS 

Audit and Accounting Manual: Nonauthoritative Technical 

L P.K-I% S * ctlon MM 40UO: American Institute of 
Public Accountants, New York, 1979 



Audit Guide for Assessing Reliability of Computer Output : 
U.S. Dapartment of Commerce/National Bureau of 
Standards. 

Audit Guide for Reliability Assessment of Controls in 

Computerized Systems. CFinnr^ Q i KI-**-^^? rtn-Ht:-): 
U.S. General Accounting Office, Washington, 1978. 

Commission on Auditor's Responsibilities. "Report Conclusions 
ana Recommendations": American Institute of Certified 
Public Accountants, New York, 1978. 

Computer Security Publications: Institute of Computer 
Sciences and Technology NBS Publications List 91, 
Washington, 1979. 

Conclusions and Recommendations of the Special Adv 

^T^f??l 01 l ^P?^ 5 .^ M ^ na ^ emen 5. : * ma ^n 

01 ^ertitied Public Accountants, Mew York, 1979. 
Controlling Assets and Transactions : How to Review and 
New r ?o?k Accounttn 8 Control: Touche Ross 



Co., 



Enhancing Government Accountability, a Program for Evalu, 
Accounting Controls and Improving Public Reporting: 
frice Waterhouse & Co., New York, 1979'i 

Evaluating Internal Control - A Guide for Management and 
JJlrectorT: srnst & Whinney, Cleveland, 179 



FOC . U uJiu.i: h Tl RO:i ! th g ^grma Auditor : Foundation for 
Audi^tttilicy Kesearch and Kducation, Inc., Institute for 
Internal Auditors, Inc., Altamonte Springs, Florida? 



- 52 - 

REPORTS AND PUBLICATIONS (Cont.) 

Glossary for Computer Systems Security: Federal Information 
Processing Systems Publication 39, Washington, 1976. 

A Guide for Studying and Evaluating Internal Accounting 
Controls: Arthur Andersen I Co., Chicago 19yd. 

Guide to Accounting Controls: Establishing. Evaluating and 

Monitoring Controls Systems. Price Waterhouse & Co.. Hew 
loric, 1979. 

Guidelines for Automatic Data Processing Risk Analysis: 

federal Information Processing Systems Publication 65, 
Washington, 1979. 

Guidelines for Automatic Data Processing Security and Risk 
Management: Federal Information Processing Systems 
rubiication 31, Washington, 1974. 

internal Accounting Control: A Practical Approach for 
Management : Coopers & Lybrand, New York, 1979. 

Internal Auditing in Federal Agencies: Basic Principles. 

Standards and Concepts: U.S. General Accounting Office, 
Washington, J.9M. 

Internal Control - Elements of a Coordinated System and Its 
importance to Management and the Independent Public 
Accountant: American Institute of Certified Public 
Accountants, New York, 1979. 

Internal Control in U.S. Corporations: The State of the Art: 
Re s e arch Foundation o Financial Executives Institute, 

Policies and Procedures Manual for Guidance of Federal 

Agencies, Title ~T\ U.S. General Accounting Ottice, 
Washington, 1978 

Reporting on Internal Accounting Control. SAS 30: American 
Institute of Certified Public Accountants, New York, 
1980. . 



- 53 - 



REPORTS AND PUBLICATIONS- (Cont.) 

Report on the Special Advisory Committee on Internal 

Accounting ControT: American Institute of Certi fled 
Public Accountants, New York, 1979. 

Security of Federal Automated Information Systems: U.S. 

uttice ot Management and Budget Circular Number A-71, 
Transmittal Memorandum No. 1. 

Standards for the Professional Practice of Internal Auditing: 
Institute of Internal Auditors. Inc., Altamonte Springs. 
Florida, 1978. 

Statement on Auditing Procedures No. 52, "Reports on Internal 
Control Based on Criteria Established by Governmental 
Agencies": American Institute of Certified Public 
Accountants, New York, 1972. 

Statement on Auditing Procedure No. 54, "The Auditor's Study 
and Evaluation of Internal Control^ American Institute 
ot Certitied Public Accountants, New York, 1972. 

Statement on Auditing Standards No'. 1; Codification of 
Auditing Standards and Procedures. Section 320: 
American Institute of Certified Public Accountants. New 
York, 1973. 

Systems Auditabilitv and Control: Institute of Internal 
Auditors, Inc., Altamonte Springs, Florida, 1977. 

ARTICLES AND BOOKS 

Anthony, R.N. , J. Dearden and R.F. Vancil, "Management 
Control Systems: Cases and Readings": 

Anthony, R.N. , "Planning and Control Systems: A Framework 
for Analysis": Graduate School of Business 
Administration, Harvard University, Boston, 1965. 

Brink V.Z. , J.A. Cashin and H. Witt, Modern Internal 

: Operational Approach, Third Edition: 

Press, New York, 1973. 



- 54 - 



ARTICLES AND BOOKS (Cont . ) 

Carmichael, D.R., and J.J. Willingham, Auditing Concepts and 
Methods, Second Edition: McGraw-Hill Company. 

Defltese. P.L., K.P. Johnson and R.K. MacLeod, Montgomery's 
Auditing, Ninth Edition: Ronald Press Co. , New York, 

T9T5": 

Deraing, R.H. , Characteristics of an Effective Management 

Control System In an Industrial Organization: Graduate 
School of Business Administration, Harvard University, 
Boston, 1978. 

Master, Albert, Jr., and Kenneth S. Johnson, "Assessing 
Internal Accounting Control: A Workshop Approach : 
1968. 

Pomeranz, F, , A.J. Cancellieri, J.B. Stevens and J.L. Savage, 
"Auditing In the Public Sector": Warren, Gorham and 
Lament, Boston, Ma. 1976. 

Romney, Marshall B. , Albrecht, Steve and Cherrington, David 
J., "Red Flagging the White Collar Crime Wave" 
Management Accounting, 1980. 

LEGISLATION AND REGULATION 

Budget and Accounting Procedures Act of 1950 P.L. 
Foreign Corrupt Practices Act of 1977. 

Proposed Amendment to Regulation 7 (a) of Regulation S-K, 
Securities and Exchange Commission 1978 (Release No. 
34-15772, File No. 57-779) 

Proposed SEC Requirement and an Action Plan for Management 

Reports on Accounting Controls, Price Waterhouse & Co., 
New York, 1979. 



f, U.S. GOVERNMENT PRINTING OFFICE; 1931- 720-0234822 REGION 3-1 



